Buggy code:
public class XMLNSDocumentScannerImpl extends XMLDocumentScannerImpl { protected boolean fBindNamespaces ; protected boolean fPerformValidation ; protected String [ ] fUri = new String [ 4 ] ; protected String [ ] fLocalpart = new String [ 4 ] ; protected int fLength = 0 ; private XMLDTDValidatorFilter fDTDValidator ; public void setDTDValidator ( XMLDTDValidatorFilter dtd ) { } protected boolean scanStartElement ( ) throws IOException , XNIException { } private final void checkDuplicates ( QName qname , XMLAttributesImpl attributes ) { } protected void scanAttribute ( XMLAttributesImpl attributes ) throws IOException , XNIException { if ( DEBUG_CONTENT_SCANNING ) System . out . println ( ">>><seq2seq4repair_space>scanAttribute()" ) ; fEntityScanner . scanQName ( fAttributeQName ) ; fEntityScanner . skipSpaces ( ) ; if ( ! ( fEntityScanner . skipChar ( '=' ) ) ) { reportFatalError ( "EqRequiredInAttribute" , new Object [ ] { fAttributeQName . rawname } ) ; } fEntityScanner . skipSpaces ( ) ; int oldLen = attributes . getLength ( ) ; attributes . addAttribute ( fAttributeQName , fCDATASymbol , null ) ; if ( oldLen == ( attributes . getLength ( ) ) ) { reportFatalError ( "AttributeNotUnique" , new Object [ ] { fCurrentElement . rawname , fAttributeQName . rawname } ) ; } boolean isVC = ( fHasExternalDTD ) && ( ! ( fStandalone ) ) ; <START_BUG> scanAttributeValue ( this . fTempString , fTempString2 , rawname , attributes , oldLen , isVC ) ; <END_BUG> String value = fTempString . toString ( ) ; attributes . setValue ( oldLen , value ) ; attributes . setNonNormalizedValue ( oldLen , fTempString2 . toString ( ) ) ; attributes . setSpecified ( oldLen , true ) ; if ( fBindNamespaces ) { String localpart = fAttributeQName . localpart ; String prefix = ( ( fAttributeQName . prefix ) != null ) ? fAttributeQName . prefix : XMLSymbols . EMPTY_STRING ; if ( ( prefix == ( XMLSymbols . PREFIX_XMLNS ) ) || ( ( prefix == ( XMLSymbols . EMPTY_STRING ) ) && ( localpart == ( XMLSymbols . PREFIX_XMLNS ) ) ) ) { String uri = fSymbolTable . addSymbol ( value ) ; if ( ( prefix == ( XMLSymbols . PREFIX_XMLNS ) ) && ( localpart == ( XMLSymbols . PREFIX_XMLNS ) ) ) { fErrorReporter . reportError ( XMLNS_DOMAIN , "CantBindXMLNS" , new Object [ ] { fAttributeQName } , SEVERITY_FATAL_ERROR ) ; } if ( uri == ( NamespaceContext . XMLNS_URI ) ) { fErrorReporter . reportError ( XMLNS_DOMAIN , "CantBindXMLNS" , new Object [ ] { fAttributeQName } , SEVERITY_FATAL_ERROR ) ; } if ( localpart == ( XMLSymbols . PREFIX_XML ) ) { if ( uri != ( NamespaceContext . XML_URI ) ) { fErrorReporter . reportError ( XMLNS_DOMAIN , "CantBindXML" , new Object [ ] { fAttributeQName } , SEVERITY_FATAL_ERROR ) ; } } else { if ( uri == ( NamespaceContext . XML_URI ) ) { fErrorReporter . reportError ( XMLNS_DOMAIN , "CantBindXML" , new Object [ ] { fAttributeQName } , SEVERITY_FATAL_ERROR ) ; } } prefix = ( localpart != ( XMLSymbols . PREFIX_XMLNS ) ) ? localpart : XMLSymbols . EMPTY_STRING ; if ( ( uri == ( XMLSymbols . EMPTY_STRING ) ) && ( localpart != ( XMLSymbols . PREFIX_XMLNS ) ) ) { fErrorReporter . reportError ( XMLNS_DOMAIN , "EmptyPrefixedAttName" , new Object [ ] { fAttributeQName } , SEVERITY_FATAL_ERROR ) ; } fNamespaceContext . declarePrefix ( prefix , ( ( uri . length ( ) ) != 0 ? uri : null ) ) ; attributes . setURI ( oldLen , fNamespaceContext . getURI ( PREFIX_XMLNS ) ) ; } else { if ( ( fAttributeQName . prefix ) != null ) { attributes . setURI ( oldLen , fNamespaceContext . getURI ( prefix ) ) ; } } } if ( DEBUG_CONTENT_SCANNING ) System . out . println ( "<<<<seq2seq4repair_space>scanAttribute()" ) ; } protected int scanEndElement ( ) throws IOException , XNIException { } public void reset ( XMLComponentManager componentManager ) throws XMLConfigurationException { } protected Dispatcher createContentDispatcher ( ) { } protected final class NSContentDispatcher extends ContentDispatcher { protected boolean scanRootElementHook ( ) throws IOException , XNIException { } } }

Fix:
scanAttributeValue ( this . fTempString , fTempString2 , rawname , attributes , oldLen , isVC , fCurrentElement . rawname ) ;